Malicious npm Package imgdecode Hides a Shellcode Loader in a Windows Native Addon

Researchers at SafeDep have detailed imgdecode, a malicious npm package that belongs to a recently disclosed software supply chain campaign dubbed MALFEX. The package was uploaded on September 30, 2026, by a user named malfexteste8; at the time of writing it has been downloaded 979 times, is still available, and sits at version 1.0.3.

In just nine lines of JavaScript the package loads a compiled Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL downloads encrypted shellcode from GitHub, decrypts it, and injects the result into a newly spawned dllhost.exe process.

A long-running campaign

MALFEX was first documented by both Checkmarx and CloudSEK. They attribute it to an unknown actor who has been publishing malicious packages to npm since August 6, 2023, across five publisher handles. Of eight identified packages, three acted as loaders for the Overlord RAT, while cdn-img-fetch, img-to-native, and native-runner worked together to download and run a Node.js stealer. A third infection path relied on a postinstall hook.

Tellingly, the operator responds to public disclosure and npm takedowns by shipping replacements fast: after native-runner and img-to-native were removed, runhelper and imgbundle appeared within two days, and imgdecode's first version landed the same day. From version 1.0.1 the DLL downloads and decrypts the payload itself, and version 1.0.3 drops any dependency on other MALFEX packages entirely.

A built-in kill switch

The addon is a 64-bit MSVC-built DLL. It first checks whether it is running in a developer's terminal, then fetches banner.jpg from the cavecrew/proj repository, decrypts the embedded payload with the key nif-runtime-2027, and injects the output into dllhost.exe. Notably, if the first bytes of the decrypted data match a JPEG or PNG signature, the DLL halts — which, the researchers infer, lets the operator switch the loader off simply by serving content that decrypts to an image.

The final payload is a stealer and remote access tool called movinlike. It checks for virtual machines, sandboxes, and analysis tools such as Process Monitor and Wireshark, then harvests files matching seed phrases and the extensions .kdbx, .pem, .ppk, and .env, along with data from Chromium browsers, Discord, Telegram, crypto wallets, and gaming apps. A WebSocket connection to the C2 server lets it take commands, while persistence is achieved via a Registry Run key and a scheduled task named MicrosoftEdgeUpdateService.

Developers who installed any of these packages are advised to treat their Windows systems as compromised: isolate them, check for persistence entries, rotate credentials, and move funds to new wallets.

Source: The Hacker News